Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,698cataloged exploits

35,718CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,491GitHub PoC 14,271VulnCheck XDB 8,693Nuclei 4,314Metasploit 3,474✓ verified onlyrecent popular risk

24,455 exploits

Exploit-DB✓ VexDay Proof

Tiny Web Gallery 1.4 - 'index.php' Cross-Site Scripting

CVE-2006-1802—webappsphp15 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in TinyWebGallery 1.3 and 1.4 allows remote attackers to inject ar

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Symantec Sygate Management Server - 'LOGIN' SQL Injection (Metasploit)

CVE-2006-0522—webappscgi15 Apr 2006

SQL injection vulnerability in the Authentication Servlet in Symantec Sygate Management Server (SMS) version 4.1 build 1

23RISK

open ↗

Exploit-DB✓ VexDay Proof

PHPAlbum 0.2.2/0.2.3/4.1 - 'Language.php' File Inclusion

CVE-2006-1839—webappsphp15 Apr 2006

PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows r

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Farsinews 2.1/2.5 - 'search.php' Cross-Site Scripting

CVE-2006-1822—webappsphp14 Apr 2006

Cross-site scripting (XSS) vulnerability in search.php in FarsiNews 2.5.3 Pro and earlier allows remote attackers to inj

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Papoo 2.1.x - 'print.php' Cross-Site Scripting

CVE-2006-1918—webappsphp14 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in Papoo 2.1.5 allow remote attackers to inject arbitrary web script

23RISK

open ↗

Exploit-DB✓ VexDay Proof

AR-Blog 5.2 - 'print.php' Cross-Site Scripting

CVE-2006-1893—webappsphp14 Apr 2006

Cross-site scripting (XSS) vulnerability in print.php in ar-blog 5.2 allows remote attackers to inject arbitrary web scr

23RISK

open ↗

Exploit-DB✓ VexDay Proof

MODx CMS 0.9.1 - 'index.php' Cross-Site Scripting

CVE-2006-1820—webappsphp14 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web scri

23RISK

open ↗

Exploit-DB✓ VexDay Proof

MODx CMS 0.9.1 - 'index.php' Directory Traversal

CVE-2006-1821—webappsphp14 Apr 2006

Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (d

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Opera Web Browser 8.52 - Stylesheet Attribute Buffer Overflow

CVE-2006-1834—doslinux13 Apr 2006

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a sty

28RISK

open ↗

Exploit-DB✓ VexDay Proof

PowerClan 1.14 - 'member.php' SQL Injection

CVE-2006-1805—webappsphp13 Apr 2006

SQL injection vulnerability in member.php in PowerClan 1.14 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

W3C Amaya 9.4 - legend color Attribute Value Overflow

CVE-2006-1900—dosmultiple13 Apr 2006

Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before

28RISK

open ↗

Exploit-DB✓ VexDay Proof

SimpleBBS 1.0.6/1.0.7/1.1 - Arbitrary Command Execution

CVE-2006-1800—webappsphp13 Apr 2006

Directory traversal vulnerability in posts.php in SimpleBBS 1.0.6 through 1.1 allows remote attackers to include and exe

23RISK

open ↗

Exploit-DB✓ VexDay Proof

LifeType 1.0.3 - 'index.php' Cross-Site Scripting

CVE-2006-1808—webappsphp13 Apr 2006

Cross-site scripting (XSS) vulnerability in index.php in Lifetype 1.0.3 allows remote attackers to inject arbitrary web

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Adobe Document Server 6.0 Extensions - 'AlterCast?op' Cross-Site Scripting

CVE-2006-1786—remotemultiple13 Apr 2006

Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to i

28RISK

open ↗

Exploit-DB✓ VexDay Proof

W3C Amaya 9.4 - textarea rows Attribute Value Overflow

CVE-2006-1900—dosmultiple13 Apr 2006

Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Adobe Document Server 6.0 Extensions - 'ads-readerext?actionID' Cross-Site Scripting

CVE-2006-1786—remotemultiple13 Apr 2006

Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to i

28RISK

open ↗

Exploit-DB✓ VexDay Proof

PlanetSearch + - 'Planetsearchplus.php' Cross-Site Scripting

CVE-2006-1801—webappsphp13 Apr 2006

Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbi

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Plone 2.x - MembershipTool Access Control Bypass

CVE-2006-1711—remotelinux12 Apr 2006

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait,

23RISK

open ↗

Exploit-DB✓ VexDay Proof

PatroNet CMS - 'index.php' Cross-Site Scripting

CVE-2006-1783—webappsphp12 Apr 2006

Cross-site scripting (XSS) vulnerability in PatroNet CMS allows remote attackers to inject arbitrary web script or HTML

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Interaktiv.shop 4/5 - Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1709—webappscgi12 Apr 2006

Cross-site scripting (XSS) vulnerability in shop_main.cgi in interaktiv.shop 5 allows remote attackers to inject arbitra

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Chipmunk Guestbook 1.3 - 'index.php' SQL Injection

CVE-2006-1683—webappsphp12 Apr 2006

SQL injection vulnerability in admin/login.php in Chipmunk Guestbook allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Exploit-DB✓ VexDay Proof

JetPhoto 1.0/2.0/2.1 - 'detail.php?page' Cross-Site Scripting

CVE-2006-1760—webappsphp11 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in JetPhoto allow remote attackers to inject arbitrary web script or

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Microsoft FrontPage - Server Extensions Cross-Site Scripting

CVE-2006-0015—webappscgi11 Apr 2006

Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002

28RISK

open ↗

Exploit-DB✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-2029—webappsphp11 Apr 2006

Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.3 and earlier allow remote attackers to execute ar

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Saxopress - 'URL' Directory Traversal

CVE-2006-1771—remotewindows11 Apr 2006

Directory traversal vulnerability in misc in pbcs.dll in SAXoTECH SAXoPRESS, aka Saxotech Online (formerly Publicus) all

23RISK

open ↗

Exploit-DB✓ VexDay Proof

SWSoft Confixx 3.0.6/3.0.8/3.1.2 - 'index.php' SQL Injection

CVE-2006-1754—webappsphp11 Apr 2006

SQL injection vulnerability in index.php in SWSoft Confixx 3.0.6, 3.0.8, and 3.1.2 allows remote attackers to execute ar

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Clever Copy 3.0 - 'Connect.INC' Information Disclosure

CVE-2006-1718—webappsphp11 Apr 2006

Magus Perde Clever Copy 3.0 and earlier stores sensitive information under the web root with insufficient access control

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Tritanium Bulletin Board 1.2.3 - Multiple Cross-Site Scripting Vulnerabilities

CVE-2006-1768—webappsphp11 Apr 2006

Multiple cross-site scripting (XSS) vulnerabilities in register.php in Tritanium Bulletin Board (TBB) 1.2.3 allow remote

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Indexu 5.0 - Multiple Remote File Inclusions

CVE-2006-1767—webappsphp11 Apr 2006

Multiple PHP remote file inclusion vulnerabilities in nicecoder.com INDEXU 5.0.0 and 5.0.1 allow remote attackers to exe

23RISK

open ↗

Exploit-DB✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-0146—webappsphp11 Apr 2006

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.